Vulnerability Intelligence Report
PaperCut NG/MF: User enumeration via timing attack
CVE-2026-8794
PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a valid account is supplied, creating a measurable timing oracle that reveals account existence.
No Active Exploit Signals
CVSS Base Score
6.9
MEDIUM
EPSS Probability:0.68%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-208 ↗CWE-208 Observable timing discrepancy
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| PaperCut | PaperCut NG/MF | 0 < 26.0.3 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.676%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | PaperCut Software Pty Ltd · Vendor · Australia |
| Reserved | 2026-05-17T23:10:23 |
| Published | 2026-08-03T07:02:42 |
| Last Updated | 2026-08-03T14:30:36 |
Community Chatter & Buzz